Lesson 1 of 3
Backups that actually work
2 min
A backup you've never restored is a hope, not a backup.
The 3-2-1 rule
- 3 copies of your data
- on 2 different types of storage
- with 1 copy off-site
Add one more for ransomware: at least one copy should be immutable or offline, so an attacker with your server's credentials can't delete it.
What to back up
- Databases, with a consistent dump (
mysqldump --single-transaction) - Uploaded files and site code
- Configuration: web server, DNS zone exports, cron jobs
- Credentials and keys, encrypted, in a separate secure place
Decide your targets
- RPO (recovery point): how much data you can afford to lose. Nightly backups mean up to 24 hours.
- RTO (recovery time): how long you can be offline while restoring.
These two numbers decide how often you back up and how you store it.
Test restores
Every month, restore to a separate server and check that the site works. Time it; that's your real RTO.
Backups stored on the same server, or reachable with the same password, disappear in the same incident.